Splunk Search

Extract field

Sekhar
Explorer

Log like.

message: [22/09/23 10:31:47:935 GMT] [ThreadPoolExecutor-thread-15759] INFO failed.", suspenseAccountNumber="941548131", suspenseAccountBSB="083021", timeCreate

as OTHER BUSINESS REASON returned by

CBIS.", debtor RoutingType="BBAN", debtor Routing Id="013013", creditor RoutingType="BBA

6899-422f-8162-6911da94e619", transactionTraceIdentification-1311b8a21-6d6c-422b-8

22T10:31:42.8152_00306", instrId="null", interactionId="null", interactionOriginators tx_uid-ANZBAU3L_A_TST01_ClrSttlmve01_2023-09-22T10:31:42.8152 00306, txId-ANZBAU3L priority-NORM, addressingType=noAlias, flow-N5XSuspense.receive]

 

 

How extract the transactionTraceIdentification filed 

 

I tried already rex field= message "transactionTraceIdentification=\"(?<transactionTraceIdentification>.*?)\","

 

Not extraxted the vaule

Labels (1)
0 Karma

Sekhar
Explorer

I tried getting empty 

0 Karma

yeahnah
Motivator

Likely message is not an extracted field then. 

Try this to extract from the _raw event

| rex field=_raw "transactionTraceIdentification-(?<transactionTraceIdentification>[^\"]+)

 

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @Sekhar your one line reply will not help us to help you.. pls write your full search query.. 

provide some more sample log lines.. 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @Sekhar ... pls provide some more log lines.. 

pls check this rex.. 

Splunk newbie learning videos, for absolute beginners:
https://www.youtube.com/@SiemNewbies101/playlists

i have added 24 small videos of rex... completely for splunk newbies and beginners.

source="rex.txt" host="laptop" sourcetype="rextest" | rex field=_raw "transactionTraceIdentification\-(?<transactionTraceIdentification>.*)" | table _raw transactionTraceIdentification
thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

yeahnah
Motivator

Hi @Sekhar 

try this..

| rex field=message "transactionTraceIdentification-(?<transactionTraceIdentification>[^\"]+)"

 

hope that helps

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...